CVE-2026-93712: Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler
Dancer2 before 2.2.0 can serve files outside public_dir via relative path segments.
44
Vulnerability1 · 1 read
CVE-2026-93712
Unauthenticated RCE in Dancer2 2.1.0 before 2.2.0 for Perl
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Dancer2 versions from 2.1.0 before 2.2.0 contain a vulnerability in the File route handler that allows unauthenticated access to files outside public_dir via relative path segments. An attacker can use requests like /../outside.txt or percent-encoded dots to reach arbitrary files, including application config.yml. The flaw is enabled when the File route handler is named and static_handler is set to 0, and it can serve any file the worker process can read without authentication.
What to do: Upgrade to Dancer2 2.2.0 or later. Disable the File route handler or set static_handler to 0 to prevent serving files outside public_dir. Verify that no attacker-controlled path or request can reach config.yml or other files outside public_dir.
| Product | Affected |
|---|---|
| Dancer2 (Perl) | 2.1.0 before 2.2.0 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. The handler joins the request path onto public_dir without collapsing relative segments, and checks only that the result is a readable regular file. A request for `/../outside.txt` escapes public_dir, and percent-encoding the dots reaches the same file. The handler is off by default. An application is affected once it names File in route_handlers and sets static_handler to 0, which otherwise refuses a dot segment before the route runs. Any file the worker process can read is served to an unauthenticated request, including the application's config.yml above public_dir.
- Weakness
- CWE-22
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N